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AMENDMENTS TO THE CLAIMS 

Upon entry of this amendment, the following listing of claims will replace all prior 
versions and listings of claims in the pending application. 

IN THE CLAIMS 

Please cancel claims 1-41 and add new claims 42-61 as follows: 
1-41 (Cancelled). 

42. (New) A method for adaptive ly generating exception rules to rejection rules for filtering 
messages, comprising: 

(a) receiving, by an intermediary device between a client and a server, a first 
message having a first URL component comprising a plurality of hierarchically related 
URL components, the plurality of hierarchically related URL components comprising a 
first URL component and a second URL component, the second URL component being a 
descendant of the first URL component; 

(b) rejecting, by the intermediary device, the first message based on a rejection 
rule that rejects messages having the first URL component; 

(c) maintaining, by the intermediary device, a first number of occurrences of the 
first URL component in messages received by the intermediary device; 

(d) maintaining, by the intermediary device, a second number of occurrences of 
the second URL component in messages received by the intermediary device; 

(e) determining, by the intermediary device, that a function of the first number of 
occurrences and the second number of occurrences exceeds a threshold; 
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(f) generating, by the intermediary device, an exception rule to the rejection rule 
responsive to the determination, the exception rule allowing messages having the first 
URL component to pass; 

(g) receiving, by the intermediary device, a second message having the first URL 
component; and 

(h) allowing, by the intermediary device, the second message to pass between the 
client and the server based on the exception rule that allows messages having the first 
URL component to pass. 

43. (New) The method of claim 42, wherein exceeding the threshold further comprises having 
the first number of occurrences of the first URL component in messages received exceeding the 
threshold, the first URL component having no descendents with a number of occurrences in 
messages received exceeding the threshold. 

44. (New) The method of claim 42, further comprising defining the function is a sum of at least 
the first number of occurrences and the second number of occurrences . 

45. (New) The method of claim 42, further comprising defining the function as a function of the 
first number of occurrences and a number of occurrences of each descendant of the first URL 
component in messages received by the intermediary device. 
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46. (New) The method of claim 42, further comprising defining the threshold as a product of a 
total number of messages over a time interval and a percentage of the messages that should be 
allowed. 

47. (New) The method of claim 42, further comprising generating the exception rule by 
inferencing a scalar data type of the descendants of the first URL component. 

48. (New) The method of claim 42, further comprising defining the function as a direct count of 
the occurrences of the first URL component. 

49. (New) The method of claim 42, further comprising defining the function as a weighted count 
of the occurrences of the first URL component. 

50. (New) The method of claim 42, further comprising storing, by the intermediary device the 
URL in a trie structure, wherein each URL component of the plurality of hierarchically related 
URL components is associated with a node in the trie structure. 

5 1 . (New) The method of claim 50, further comprising maintaining the function in a node of the 
trie structure associated with the first URL component. 

52. (New) A system for adaptively generating exception rules to rejection rules for filtering 
messages received by an intermediary device, comprising: 
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means for receiving a first message having a first URL, the first URL comprising 
a plurality of hierarchically related URL components, the plurality of hierarchically 
related URL components comprising a first URL component and a second URL 
component, the second URL component being a descendant of a first URL component, 
wherein the first message is rejected based on a rejection rule that rejects messages 
having the first URL component; 

means for maintaining a first number of occurrences of the first URL component 
in messages received by the device, and a second number of occurrences of the second 
URL component in messages received by the device; 

means for determining that a function of the first number of occurrences and the 
second number of occurrences exceeds a threshold; and 

means for generating an exception rule to the rejection rule for the first node 
associated with the first URL component responsive to the determination, the exception 
rule allowing messages having the first URL component to pass; and 

means for allowing the second message to pass between the client and the server 
based on the exception rule that allows messages having the first URL component to 
pass. 

53. (New) The system of claim 53, wherein exceeding the threshold comprises having the first 
number of occurrences of the first URL component in messages received exceeding the threshold, 
the first URL component having no descendents with a number of occurrences in messages 
received exceeding the threshold. 
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54. (New) The system of claim 53, wherein the function is a sum of at least the first number of 
occurrences and the second number of occurrences. 



55. (New) The method of claim 53, wherein the function is a function of the first number of 
occurrences and a number of occurrences of each descendant of the first URL component in 
messages received by the device. 

56. (New) The system of claim 53, wherein the threshold is a product of a total number of 
messages over a time interval and a percentage of the messages that should be allowed. 

57. (New) The system of claim 53, wherein the exception rule is generated by inferencing a 
scalar data type of the descendants of the first URL. 

58. (New) The system of claim 53, wherein the function is a direct count of the first number of 
occurrences of the first URL component. 

59. (New) The system of claim 53, wherein the function is a weighted count of the number of 
occurrences of the first URL component. 

60. (New) The system of claim 53, further comprising means for storing the URL in a trie 
structure such that each URL component of the plurality of hierarchically related URL 
components is associated with a node in the trie structure. 
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61. (New) The system of claim 60, further comprising means for maintaining the function in a 
node of the trie structure associated with the first URL component. 



62. (New) A method for adaptive ly generating exception rules to rejection rules for filtering 
messages, comprising: 

(a) receiving, by an intermediary device between a client and a server, a first 
message having a first URL component comprising a plurality of hierarchically related 
URL components, the plurality of hierarchically related URL components comprising a 
first URL component and a second URL component, the second URL component being a 
descendant of the first URL component; 

(b) rejecting, by the intermediary device, the first message based on a rejection 
rule that rejects messages having the first URL component; 

(c) maintaining, by the intermediary device, a first number of occurrences of the 
first URL component in messages received by the intermediary device; 

(d) maintaining, by the intermediary device, a second number of occurrences of 
the second URL component in messages received by the intermediary device; 

(e) determining, by the intermediary device, that a function of the first number of 
occurrences and the second number of occurrences exceeds a threshold; 

(f) generating, by the intermediary device, an exception rule to the rejection rule 
responsive to the determination, the exception rule allowing messages having the first 
URL component to pass; 

(g) receiving, by the intermediary device, a second message having the first URL 
component; 
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(h) identifying, by the intermediary device, that the second message having the 
first URL component is rejected by the rejection rule; 

(i) determining, by the intermediary device, that the rejection rule has an 
exception rule that may allow a message that has been rejected by the rejection rule to 
pass; and 

(j) allowing, by the intermediary device, the second message to pass between the 
client and the server based on the exception rule that allows messages having the first 
URL component to pass. 
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